-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| io.jenkins.plugins:dingding-notifications | maven | <= 1.9 | 2.0.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from unencrypted storage of credentials in config.xml files. The DataBoundConstructor in DingdingNotifier directly handles the access token as a plain string parameter, which gets serialized to job configurations. The commit b2d4b3e fixes this by replacing String-based credential handling with Jenkins' Secret class, indicating these were the vulnerable entry points. The removal of these classes in the patch confirms their role in the vulnerability.